Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,588 detections
Filters
Last updated
All Time
Detection languages
1,194
459
310
204
161
Contributors
487
455
323
171
123
Categories
1,884
937
415
400
360
Platforms
1,349
560
343
329
257
Products / Services
601
314
306
286
271
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
2,588
CVEs
9
5
5
5
2
IDS Classtypes
142
96
49
11
6
IDS Protocols
177
49
44
17
4
This rule detects outbound network connections to URLs associated with common file sharing services (e.g., Dropbox, Mega, Gofile) or temporary email providers (e.g., Temp-Mail). Such connections can indicate data exfiltration attempts, use of unsanctioned services, or communication with command and control infrastructure.
This rule detects potentially malicious data exfiltration activity. It identifies sequences of events where a process performs file enumeration (directory listing), followed by the creation of a ZIP or RAR archive in temporary or local application data directories with randomized filenames. Finally, it correlates this behavior with subsequent outbound network connections from the same process to known cloud storage and file-sharing providers, flagging anomalous archive creation rates.
Detects network connections from suspicious or unexpected processes to common public webhook and automation services, which may indicate data exfiltration or automated C2 communication.
This rule detects network activity associated with the easy-day-js Mastra npm supply chain attack. Specifically, it identifies data exfiltration over TLS to a secondary C2 server (23.254.164.123:443) and the download of a stage-2 payload from a primary C2 server (23.254.164.92:8000) via HTTP, looking for the URI '/update/49890878'.
Detects suspicious interactions with Google Cloud Pub/Sub APIs occurring shortly after an OAuth2 token request, specifically when the activity is performed by processes other than standard Google Cloud SDK tools (gcloud, gsutil, etc.). This behavior may indicate an attempt to utilize stolen OAuth tokens to exfiltrate or manipulate data within a GCP environment.
Detects outbound network connections to common Mythic C2 ports initiated by processes identified as compiler-related binaries (Go, Zig, Rust) or binaries running from suspicious, user-writable directories (Temp, AppData, etc.). This behavior is consistent with the execution of staging or initial implants associated with the Mythic post-exploitation framework.
Detects unauthorized HTTPS POST requests to sensitive GitHub API endpoints (gists, repository contents, user emails) originating from standard command-line tools like curl, node, and PowerShell. Additionally, it identifies suspicious git push operations initiated from within node-based installation scripts, which is indicative of credential harvesting and exfiltration behaviors exhibited by the Miasma worm.
Detects the use of legitimate Windows binaries (Certutil and BITSAdmin) to communicate with external, non-Microsoft IP addresses, which is indicative of potential tool downloading or data exfiltration. The rule explicitly filters out known Microsoft update domains to reduce noise.
Detects network connections to the Telegram API (api.telegram.org) from processes identified as LOLBins or residing in suspicious, potentially writable locations such as Temp, AppData, or user-defined directories. This activity is often indicative of C2 communication or data exfiltration by malware bypassing standard messaging client restrictions.
Detects the use of legitimate Windows binaries (Certutil and BITSAdmin) to communicate with external, non-Microsoft IP addresses, which is indicative of potential tool downloading or data exfiltration. The rule explicitly filters out known Microsoft update domains to reduce noise.
Detects network connections to Filen.io cloud storage initiated by processes other than common web browsers. This behavior is often associated with the use of command-line tools or scripts for unauthorized file exfiltration or data staging.
Detects attempts to exfiltrate data through Microsoft Copilot Enterprise Search by identifying URL clicks containing specific keywords ('extract', 'embed', 'img') in the query parameters. This could indicate an adversary trying to extract sensitive information or embed malicious content.
This rule detects the presence of Phoenix malware by identifying known SHA256 hashes of its components or network connections to its command and control (C2) infrastructure. It correlates file events with known malware hashes and network events with known C2 IP addresses.
Detects anomalous activities targeting SaaS CRM applications (Salesforce, Microsoft Dynamics 365, HubSpot), including high-volume bulk exports, off-hours access, mass API queries for sensitive objects, and suspicious OAuth token grants.
This rule monitors for high frequency network connections (more than 50 requests) initiated from internal endpoints to external (non-RFC1918) IP addresses over port 443. This pattern may indicate beaconing activity, command and control (C2) communication, or significant data exfiltration to an external host.
Detects S3 bucket lifecycle policies configured for automatic object deletion
Detects HTTP PUT requests directed at Wasabi Cloud Storage domains that originate from an Rclone user agent. This pattern is commonly indicative of data exfiltration activities where an attacker uses the Rclone utility to synchronize or upload sensitive data to unauthorized cloud storage.
This rule monitors DeviceNetworkEvents to identify processes that are not typically associated with cloud storage and synchronization software initiating network connections on port 443 to popular cloud providers (OneDrive, SharePoint, Dropbox). This behavior is often indicative of data exfiltration to cloud storage services or potential command and control communication disguised as web traffic.
This rule monitors DeviceNetworkEvents to identify processes that are not typically associated with cloud storage and synchronization software initiating network connections on port 443 to popular cloud providers (OneDrive, SharePoint, Dropbox). This behavior is often indicative of data exfiltration to cloud storage services or potential command and control communication disguised as web traffic.
Detects data exfiltration through Discord webhook POST requests
This rule detects network connections to known cloud storage, file hosting, and webhook services (Discord, Pastebin, Dropbox, Telegram, AnonFiles) initiated by processes other than standard web browsers. Such behavior is often indicative of data exfiltration or C2 activity using legitimate web services to blend in with normal traffic.
Page 53 of 124